要描述：4 K7 x4 n5 g1 `
- U& T( Z* P( x" a
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
! ]* N. T {1 J8 ~1 @. p详细说明：
6 t8 s+ j% k/ |% e0 {Islogin //判断登录的方法
* e) N+ }/ ?, Z: Q! r( I8 ]( W
n3 h% A) T- X( k0 Z( w1 s8 Usub islogin()0 }! T3 z) b% W, L: E, P% j" c; w: f
s3 Z p( G% {$ j0 S) Wif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
( y" k. E2 V8 w* z: c! P3 H+ b" t# ]
; ?! y+ V: J' s( O; O$ M% p* R( qdim t0,t1,t2 7 B- ^, |' [7 Z% F+ H
, R7 v3 J7 L7 \; [( y: V1 ~t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie ! y' S/ _6 B) o4 M# F0 s
- u. @! V$ S% F7 v- ^1 e/ ^t1=sdcms.loadcookie("islogin")
5 s, L* N; T1 y$ b$ r. r6 l; A) [
2 K9 D( t: i; e& \t2=sdcms.loadcookie("loginkey")
0 t/ V- V d, }2 y4 k% T0 P 5 n1 Z5 F9 I R; |. N
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
. W6 @$ Z& `6 y4 w) |6 ]6 [" Y
: s8 ]9 ^! }3 s5 W \, N//
* \( h n% l, q& w3 E% y/ Z$ C7 q5 o5 U
8 U# [! D# q/ ?1 A, f7 t2 `6 lsdcms.go "login.asp?act=out"
7 y# g3 ~3 w- P! w$ _- \
! e# O: W5 @ l: \exit sub
* }+ z' k" ]! B ?
7 M* i5 U( V2 s) I: w3 @8 Oelse
6 ^) W7 h- O1 ^# q - v9 r* Y5 Z% _
dim data
4 h) a; E& e9 F) l8 k
/ m4 n: D7 t ?7 A( U6 y9 V. H$ _data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
8 W* C+ s( q, c- O' E; o5 S 5 G& y2 l/ ~ x
if ubound(data)<0 then
! V3 J; r% a; W3 c
" f! o5 u) i2 c8 lsdcms.go "login.asp?act=out"
, r! p$ _* L; i h1 u5 E [ + t9 {# {9 U8 M2 [6 k; h
exit sub* Z m1 \ t7 |- m/ s# c
; ~: o4 r* @( V% z5 n: J- }+ W1 C ]
else
6 R& m) U2 G% ?) X) P
2 U3 v; z& S& p3 X4 A: J. I Fif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
. ~; @# `- O& C# |) p: R+ j 2 U/ x+ l2 } N H' s
sdcms.go "login.asp?act=out"
# w& G- j/ B, _9 k6 Y ! \8 u8 `1 ]9 `/ u7 B* Y
exit sub
( \. h3 S" G8 D
( o! C5 ]2 y7 Q4 pelse* e; e+ O% ]+ D5 t7 [' p8 d# c
' i2 g: h$ A% E: badminid=data(0,0)4 |2 C" W, X+ V7 I" g7 ^
. A y$ K: I) W! K; d% [adminname=data(1,0)8 u! j& b4 ]" G$ p; O
" X! E: o$ ^7 S: O7 L" j
admin_page_lever=data(5,0)
! L- {6 C7 H! T5 W! y+ V' Z ; ]) c0 l' ?$ H
admin_cate_array=data(6,0)
5 h* H' A! U$ }9 @$ L$ t
0 F( E5 _2 v9 r0 padmin_cate_lever=data(7,0)7 @) _2 G O3 B m' ~& M6 G
7 f0 g/ H9 O! w( C! m" e
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0* }' p- M d/ w1 X5 p0 V u
3 G: L9 f3 q" i: c. nif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
- a% _( n% I( Y 9 w. Q6 u2 P+ i" B8 c
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0% \& T! V3 s% ]3 S0 N5 `( h+ e
: S2 n$ h' @1 e8 D7 _8 n# n
if clng(admingroupid)<>0 then
, a* K D9 N9 T- D/ `2 n& L. A* ` 9 L( J2 }4 k) o) x. t" b
admin_lever_where=" and menuid in("&admin_page_lever&")"
3 n& A- g" x0 h& t8 \9 b - {, j+ H+ w1 v3 q# o) } _
end if$ g* I6 K% l; P9 U4 N$ n0 f# e1 P9 [
* F0 [" H. Z/ v5 R, n& Ysdcms.setsession "adminid",adminid V' _5 W# `1 E% P) W5 T3 u
( A! S8 U3 Q' N) l4 jsdcms.setsession "adminname",adminname
) G- T( p: p6 P2 U* c
! ` `$ c2 Q+ Q( Csdcms.setsession "admingroupid",data(4,0)
* A& {# \, S/ ^
: J5 |' e7 {0 a# Send if7 h |: k. ^. ?; g
5 E. G, l( ?; c, a/ H5 Aend if
+ a/ _8 z& N+ L# R# \9 i( B
. [$ O5 ?0 o7 x, r9 s3 L- Eend if- ~+ R7 n, v- K9 K: x' G& k; \ d
9 o2 J3 t4 E0 g1 P! q) }! T/ U
else' o. ^( s# P0 p1 N& m
: E C# F: N" Q0 ^/ s
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
/ i0 F* S6 V( v5 `! S + i) ^( d4 z2 M
if ubound(data)<0 then
$ m' ]0 g7 |0 J, }9 l7 G/ ~& Y9 q# f ( f% Z" M; X3 i( @
sdcms.go "login.asp?act=out"# ^4 I. G$ O* W. h/ O
2 n9 Y& L/ l: K; Bexit sub u4 S5 x* m; r) z
' g8 ?; [/ S# Z# Q1 r. \9 C( y
else" {* T, c# y7 }3 l& \! a
# k3 P& Y8 J5 }
admin_page_lever=data(0,0)# m: V. r6 N4 g/ B' q8 |
1 J( @3 S) Y3 b [. ^9 V- W- I A
admin_cate_array=data(1,0), A+ U' ^3 J7 N/ s, r4 Y: u
1 l& h% a+ f) m' Q$ _& X4 K* Cadmin_cate_lever=data(2,0)
& j, \- v- J; J" [ " A' k9 O9 _, v1 H3 g, F
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
" a' A4 ~5 I8 t& n
' | |2 b1 X6 e0 Fif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
& O7 [. i4 A( S0 Y+ Y) a ( u& ~1 t; a& m, o/ n
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
& e/ O% V1 V E) z 7 U9 c( u3 l$ C+ z7 ?* |- E
if clng(admingroupid)<>0 then
$ x3 `, X( T3 |* S* ~* t 7 c% S" W' X% [
admin_lever_where=" and menuid in("&admin_page_lever&")"9 p2 P" ^ ~+ g+ J& U
& T3 _* W: @, B& `
end if+ }& J8 d7 Q, j, W0 Z
( v9 P% m" c! { j( m$ H# Q e$ jend if/ A0 n3 N6 {8 K8 G# d
; w6 @9 x7 ?% G7 }$ |
end if6 g u8 G r2 J- ^; w& G' @- Y
$ a8 l3 H5 P) ?* l: u" X
end sub
( k% c: K4 W4 a2 J. k' f+ V- N漏洞证明：
4 \* S9 P+ }$ Z7 Y- z- y* N看看操作COOKIE的函数4 X$ O+ m T8 E0 R
/ @' Z5 j3 t" \5 v) q
public function loadcookie(t0)+ U9 O% N, {1 J, Z; J: M* F( f: {
* j' j2 I( N2 i( m
loadcookie=request.cookies(prefix&t0)
. Q! }2 n1 v% h+ C+ S4 O
+ u- [& i0 L" F% Z) Kend function
0 S. p& I8 ]9 T2 S& ?8 X( K& b # J# \, q! z9 P
public sub setcookie(byval t0,byval t1)3 ~' r: x) \! d/ n6 E( I1 a8 l! A
8 g# G, h0 }) m2 d' P/ ^2 ]% W& p
response.cookies(prefix&t0)=t18 c5 S) q B! a" T# N; M! n
& k1 ]$ s) y& ]# _8 f8 xend sub
0 i2 i6 |0 M' R! H( | V7 e / m. ]2 N1 n5 j
prefix
) H& Q4 y/ o5 H$ a) r9 o
) ^4 z" k9 h2 s2 ]- C7 \; ]+ [2 D. r'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值% r0 s5 X4 S3 N! S$ ?- Y
$ L; G; w; n* _( V" T. Bdim prefix
+ h- N8 P8 \0 S. l1 E5 ?
- C& t) o8 F e+ [+ b( K+ F" Zprefix="1Jb8Ob"; |1 }& t' R1 k/ E
- h7 _6 Z, Y3 v& D7 ]3 r$ W
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里 ' c& N ]$ c7 @) b* G$ `
( j# n9 V5 i- H$ w& D% F2 n' v4 q
sub out
. ^- e; T! }0 | q | 2 D& W/ M2 U! i6 I7 @6 c
sdcms.setsession "adminid",""+ q" f& M0 P, W a" y1 }( W% b# H
2 O: W" E) P' ]. g4 T
sdcms.setsession "adminname",""
9 U* T. C+ x9 P+ Y/ j0 j% ]
: K! ~( F/ @: \sdcms.setsession "admingroupid","". B" u$ L6 u h, N8 E
0 p& R$ K! \6 }7 `9 Y
sdcms.setcookie "adminid",""
! m. N: E! m( q4 O( C3 t
2 g! C! z5 Y2 h! j$ l! ?5 x( Tsdcms.setcookie "loginkey",""
+ H5 R5 H* D5 u
2 K6 a; v6 K( n( Y3 F* lsdcms.setcookie "islogin",""9 v( ^; c5 D3 A0 F
- `1 p* t$ [ D% t2 I' _sdcms.go "login.asp"
9 Q( |7 ]+ j- Z- ~4 R# F4 R* o
+ |6 q5 S( x& ?+ P8 {end sub; w2 K) U/ Y. F% {- m4 X; r
+ s' y$ Q9 \5 n$ t+ [) f3 M x " G- v( E+ k6 ~ S- t
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！! A+ W; |: g D4 m: }3 y: ?1 G* L
修复方案：9 L! s% o) o: `* j$ s
修改函数！3 a. D& U Y0 W( f0 O
|
发表于 2013-7-26 12:42:43
收藏
支持
反对